Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Make your voice heard. Take the 2019 Developer Survey now

Questions tagged [malware]

Malware is any software application which subverts the will of the legitimate owner of a computer, by means of force or subterfuge, with or without personal or monetary gain on the part of the creator.

0
votes
2answers
52 views

Malware Analysis

What would be a good approach for testing malware or bad url's from things picked up from my SIEM to validate them? I was told to setup a VM for these tests but don't want it to hit the internal ...
0
votes
0answers
20 views

Preventing admin from changing proxy settings

I am using a proxy server for my environment deployed on premises for internal hosts and on the cloud from BYOD. When a user takes their device off the premises, the proxy changes to an external proxy ...
48
votes
10answers
8k views

Has it been mathematically proven that antivirus can't detect all viruses?

What analysis was Bruce Schneier referencing when he wrote: Viruses have no “cure.” It’s been mathematically proven that it is always possible to write a virus that any existing antivirus program ...
-1
votes
1answer
33 views

How does an antivirus flag homemade malware? [duplicate]

Say I made some malware in python or c# or whatever language, How would an antivirus detect that the program has malicious intent because how does the antivirus know that the program is malicious ...
2
votes
1answer
93 views

Why did Stuxnet have command and control servers?

I am currently reading Countdown to Zero Day which, amongst other things, describes Stuxnet in lay terms. It states that Stuxnet could report to two command and control servers. Most basic ...
0
votes
1answer
64 views

badBIOS reflashing

This is not a has-badBIOS-pwn3d-me post, so don't worry about any paranoid rants. Having read a thorough analysis/debunking of the alleged evilware, I certainly understand that the technology badBIOS ...
1
vote
0answers
41 views

How can user send malware code via input=file

After the file is uploaded via input=file it is converted to b64 standard. But what is the exact path the file is going through and where in javascript code we can catch that uploaded file. And if I ...
0
votes
0answers
53 views

Watchbog cryptomining. Who can get some more info about it? [closed]

This is a comment on a previous post A process called ./watchbog is mining crypto currency in our server. How do I stop it? It happened to me in a RHEL 6 system and wanted to share my info in case ...
0
votes
0answers
27 views

What are the steps of making a fully undetectable piece of malware? [duplicate]

I've been recently taught how antiviruses work. I know that there is more to it but they basically have a list of known malware that they have encountered and every time they scan, they check if their ...
0
votes
0answers
26 views

I am looking for names of malware that looks for certain applications or folder or ports before further execution, what are their names? [closed]

Title says it. Adding on, malware similiar to stuxnet that looks specifically for date, etc, step 7 project folder. e.g if the malware was targeting port 3306, MYSQL, it would have to scan port 3306 ...
2
votes
2answers
82 views

Security and thumb drive [duplicate]

If my laptop is locked, can a thumb drive be able to still infect my computer, or create a backdoor, or any other security risk if it's plugged into it. If so what are some example
1
vote
3answers
306 views

New Linux virus “watchbog”. What could be the cause? [duplicate]

This question had already been brought up here, but was poorly answered with generic answers, like reinstall everything and no actual solution and cause. So here's my story: There is a new virus out ...
2
votes
2answers
89 views

Can a rogue client bypass the Wi-Fi Access Point?

Let's assume that one client contains malware, and that it belongs to a Wi-Fi network protected with WPA2/Personal (hence, via a password known to the piece of malware), where some other vulnerable ...
0
votes
2answers
306 views

A process called ./watchbog is mining crypto currency in our server. How do I stop it? [duplicate]

I have found this question below but I need some more clarification that's why I am writing again. I have a process called “watchbog” that is completely hogging my CPU and I don't know what it is ...
1
vote
1answer
74 views

Explaining malware avoidance tactics

Most "how tos" regarding malware list this: Install Antivirus software. Install latest antivirus software. Run antivirus software regularly. Install latest operating system. Install any patches to ...
0
votes
1answer
74 views

How are victims targeted from outer networks (WAN)

I started getting more interested about security about one year ago, and from all the things I have learned up to this day I never knew how particular victims are targeted from the attackers from ...
3
votes
3answers
70 views

Why does VirusTotal have two different reports for the same hash depending on FILE vs URL submission?

Why would the same SHA256 Hash of a file have totally different VirusTotal results at the same time? Submitting a file to VirusTotal via File upload results in numerous hits for malware. ...
0
votes
1answer
121 views

Local Video Screenshot during Netflix

I was just binge watching Netflix from my MacBook Pro on a TV streamed using HDMI. It automatically started the final episode of the season but about 20 seconds into it, a screenshot from a local ...
0
votes
1answer
54 views

How can I detect an infection in a database?

Detecting infected files in a website or web application is very easy: you just need to compare the files with a clean backup or the original source (for example with diff) and that's it. However, ...
0
votes
1answer
23 views

read raw dump with WinDBG

Is it possible to convert a full raw dump memory and open it in WinDBG ? In order to inspect if they are no malwares, filter process who call particular API, dump each process in memory etc...
1
vote
3answers
194 views

Accidentally clicked a phishing link, am I at risk?

I clicked a link from a fake Twitch streamer and now I'm scared of being spied on. I typed my account details but didn't actually sent them because I realized it was a fake link right before clicking ...
-1
votes
1answer
54 views

If there is a way to use insecure USB-connected devices in a secure way

This is sort of like working in a lab with toxic chemicals. There is a way to work and wear certain special clothes so you don't get contaminated. Likewise, I wonder if when dealing with malware you ...
0
votes
1answer
122 views

Google Chrome Linux with Activity of Unknown Device

I've recently noticed a strange comportment on my Google Chrome Browser with GMail, where suddenly appeared a connected Unknown Device, with a double connection and with the same IP than mine, looking ...
1
vote
1answer
79 views

100% detectable backdoor attacks on network

Every article I have read on backdoor attack prevention says pretty much this: Protecting against them may be difficult. I am tired of reading how it can be ~difficult~ to protect against. ...
2
votes
0answers
82 views

BlackEnergy2 vs. BlackEnergy3: Which one targeted HMIs?

Various reports have been published that analyze BlackEnergy2 and BlackEnergy3 in-depth. However, there seems to be discrepancies regarding the malware delivery phase, i.e., initial exploitation. The ...
2
votes
1answer
82 views

Image upload meta information

I'm coding an app that allows registered users (anyone who registers) to upload images to my nodejs background (processing with sharpjs).. I remove the exif section of the image for security. However ...
3
votes
0answers
76 views

Why is Spotify using my webcam (AppleCamera)

I'm running Mac OS Mojave. I've just run the following command into terminal to see which applications are using my web cam. lsof | grep "AppleCamera" Google and Spotify showed up: Spotify 668 ...
2
votes
1answer
65 views

Does IOMMU protect against malware insertion through PCI Network card/Sound card DMA?

I've just read about this: https://www.tripwire.com/state-of-security/security-data-protection/backdoors-hardware-attacks-rakshasa-malware/ Asides from the question in the title, I'd also like to add ...
-2
votes
0answers
44 views

Google Insisting Site Is Hacked, Used All My Resources To Fix It Still Not Enough [duplicate]

I've taken action to remove the said script or link (saskmade). https://saskmade.net/head.js?ver=2.0.0 Here's what I did: Installed Wordfence scan and remove infected files Installed 2 more WP ...
4
votes
2answers
126 views

Upload malware to F-Droid repo?

What's the auditing/vetting process like to get an Android app into the F-Droid repository? To ask it another way, what's to stop an evil developer from uploading a backdoored Android app to the F-...
0
votes
1answer
55 views

Hash to malware file generation

I was watching a video from one of the youtube channel on reverse engineering. One of the topic is how to get free malware for static analysis. During the discussion, it was mentioned that people can ...
-1
votes
1answer
78 views

What hardware components in a laptop should be removed in order to prevent it from wirelessly communicating with other devices?

If you have a laptop, what hardware components should be removed in order to prevent it from wirelessly communicating with other devices? In other words, how can I prevent a laptop from getting ...
1
vote
2answers
122 views

How could malware survive hard disk drive format without residing in the firmware?

For example could it "trick" most partitioning/disk utility tools that it was successfully wiped, but with the malware still existing? Kinda similar to what would happen if you attempted to "clean" ...
1
vote
1answer
137 views

Can a smartphone get hacked even when off? [duplicate]

I've read that there are multiple batteries inside a smartphone, so even when you turn it off it can still communicate with other devices. So my question is, could a smartphone get hacked even when ...
171
votes
11answers
29k views

Search for military installed backdoors on laptop

My laptop was confiscated by the military institute of my country and they made me to give them all my passwords (I cannot tell you the name of my country). They did not give it back to me for one ...
-1
votes
1answer
85 views

Can a hacker recover deleted files from my mobile drive? [duplicate]

I deleted some files from my phone (android 5). Can a hacker recover my files?
0
votes
2answers
306 views

Suspicious new folder named .um in internal storage, google search says file is spyware

I am running Android 7.0 in a Samsung Galaxy J7 prime phone. Today, while using the phone, I suddenly found a folder named obj in Internal storage/Android, that had never been there before. It had the ...
0
votes
2answers
45 views

is encoding the same as encryption for malware obfuscation?

I have been learning about hiding and executing msfvenom created shellcode and came to a technique where we xor the shellcode and when executing we reverse it.Would it be the same if i just encrypt it ...
0
votes
1answer
128 views

Double user-agent. Malware?

The place where I work sometime is receiving some alert from the NIPS stating : [1:30918:2] "MALWARE-CNC User-Agent known malicious user agent - User-Agent User-Agent Mozilla" The user-agent in the ...
1
vote
1answer
133 views

I found an RSA private key on my ransomware-infected device. Can I use it to decrypt the files?

I have ransomware on my laptop. I ran Spyhunter and deleted as much as I could. I found an RSA in the Windows registry with regedit. Then, as I was checking for unknown files, I found a .android file ...
5
votes
1answer
788 views

I have a process called “watchbog” that is completely hogging my CPU and I don't know what it is [duplicate]

This process that has come out of nowhere is hogging my CPU and I have no clue what it is or how to get rid of it. You can see in the image below what it's doing: What is this process? How can I get ...
2
votes
1answer
91 views

Can a USB with an infected MBR or GPT harm an OS that reads it?

Assume a USB drive has an MBR or GPT that has malware in it. I already understand that booting from such a USB device would execute the malware as part of the bootloader. If I understand correctly, if ...
0
votes
2answers
129 views

How to back up and restore personal data safely from possibly exploited android phone?

I'm using a Samsung J7 Prime with Android version 7.0, not rooted. Recently, I grew suspicious I had become the target of some kind of exploit/network attack/mitm. Since I suspect the exploit is ...
4
votes
1answer
85 views

How can I recover my exploited android phone?

I have a Samsung S9 phone that has been exploited by my neighbor, however I am unsure as to how to prove/verify it, how in depth the access is to my phone, or how I can re-secure my phone. It seems ...
0
votes
2answers
101 views

Well what exactly is the difference between a virus and just plain old malware? [duplicate]

Like is malware just a computer virus or is it something completely different? I am just curious, I did watch a video on it and it did not really give me my answer that i wished for.
-2
votes
1answer
87 views

what is metasploit framework even used for? [closed]

I know how the Metasploit framework works and I know that it can generate payloads and such, my question is if there is a way to evade anti-virus using Metasploit payloads. What exact purpose does it ...
0
votes
1answer
40 views

How to protect UEM (Unified Endpoint Management) agent on your endpoint

A lot of companies install a UEM agent on employee's laptop to keep track of the health status of the laptop. And they allow the laptop to connect to the internal network if this UEM sends back "...
0
votes
1answer
366 views

Potential UEFI malware from Virus Total .rom scan

I dumped my firmware on my Macbook with Darwin Dumper and uploaded the .rom file to Virus Total and it showed a huge amount of bad PE32 images (File detail tab), all of which seem to be detected by ...
3
votes
2answers
75 views

Malware spreading via installation media

Imagine user downloads and burns installation USB stick on their compromised Linux system. Are there any known malware that is capable of spreading via Linux distributions installation media so that ...
0
votes
1answer
62 views

Is Browser-Update A Legitimate Site?

I searched this site to find if the following site is legitimate and didn't see any posts. A legitimate company is linking to this site on their front page with a warning - the site linked to: ...